Senior Security Analyst L2: Threat Hunting & SOC Automation

Ensign InfoSecurity; Singapore; Hybrid; SGD 100,000 - 150,000; Full time

Job summary

Ensign InfoSecurity in Singapore is seeking an experienced Security Operations professional to join our SOC team. You will monitor client environments, triage threats, and respond to incidents following SOPs and industry best practices.

The role involves deep-dive log analysis across Windows, Linux, and networks, mapping TTPs to MITRE ATT&CK, IOC-based hunts, and coordinating with vendors and CERTs. 12-hour shifts are required.

Responsibilities

• Monitor client environments using SIEM platforms to detect, triage, and respond to cybersecurity threats in accordance with agreed SOPs and industry best practices
• Analyse and investigate security alerts; perform deep-dive log analysis across system and OS layers to establish baselines and identify anomalous behaviour
• Map threat tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework and construct plausible attack-path hypotheses to inform containment actions
• Produce escalation reports and notes; manage triage workflow and identify improvements to automation playbooks
• Conduct IOC-based reactive threat hunts against limited TTPs
• Operate SIEM, SOAR, EDR, and wider security tooling within the scope of the service engagement
• Perform indicator of compromise (IOC) searches and triage incoming threat intelligence to assess relevance to client assets
• Coordinate with vendors, external CERTs, and internal business stakeholders during incident response activities
• Manage detection use cases, dashboards, and SOAR playbooks: author and tune detection rules, validate existing content, and implement automation to streamline triage and response
• Manage the full incident ticket lifecycle, including creation, updates, closure, hygiene, and MITRE ATT&CK mapping
• Respond to incidents and critical alerts outside of office hours when required
• Any other tasks as assigned

Job description

Ensign InfoSecurity in Singapore is seeking an experienced Security Operations professional to join our SOC team. You will monitor client environments, triage threats, and respond to incidents following SOPs and industry best practices.

The role involves deep-dive log analysis across Windows, Linux, and networks, mapping TTPs to MITRE ATT&CK, IOC-based hunts, and coordinating with vendors and CERTs. 12-hour shifts are required.